Subject: CVS commit: pkgsrc/security/openssl
From: Takahiro Kambe
Date: 2010-04-12 16:19:17
Message id: 20100412141918.00273175DF@cvs.netbsd.org

Log Message:
Update openssl package from 0.9.8m to 0.9.8n.

 Changes between 0.9.8m and 0.9.8n [24 Mar 2010]

  *) When rejecting SSL/TLS records due to an incorrect version number, never
     update s->server with a new major version number.  As of
     - OpenSSL 0.9.8m if 'short' is a 16-bit type,
     - OpenSSL 0.9.8f if 'short' is longer than 16 bits,
     the previous behavior could result in a read attempt at NULL when
     receiving specific incorrect SSL/TLS records once record payload
     protection is active.  (CVE-2010-0740)
     [Bodo Moeller, Adam Langley <agl@chromium.org>]

  *) Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL
     could be crashed if the relevant tables were not present (e.g. chrooted).
     [Tomas Hoger <thoger@redhat.com>]

Files:
RevisionActionfile
1.147modifypkgsrc/security/openssl/Makefile
1.74modifypkgsrc/security/openssl/distinfo
1.1removepkgsrc/security/openssl/patches/patch-bc